from：http://blog.csdn.net/iiprogram/article/details/4792390
自己写的PE 信息查看工具(C代码),不甚完美,希望可以帮助初学PE 的读者从编程的角度认识PE文件,Good Luck!
下面是源代码：
/*///////////////////////////////////////////////////////////////////////////////
This program will output the values of important members in the PE file
Good Luck!
///////////////////////////////////////////////////////////////////////////////*/
/*///////////////////////////////////////////////////////////////////////////////
USAGE: peinfo.exe DestinationFileName
///////////////////////////////////////////////////////////////////////////////*/
#include<windows.h>
#include<stdio.h>
#include<shlwapi.h>
/*////////////////////////////////////////////////////////////////////////////
This function is used for outputting the error information
Please use GetLastError() to retrieve the dwErrorCode,Gook Luck!*/
void OutputErrorInfo(DWORD dwErrorCode)
{
TCHAR FormattedErrorInfo[MAX_PATH];
RtlZeroMemory(FormattedErrorInfo,MAX_PATH);//Initialization
FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM,
0,
dwErrorCode,
MAKELANGID(LANG_ENGLISH,SUBLANG_ENGLISH_US),//English
// 0, //The default language of the current system
FormattedErrorInfo,MAX_PATH,NULL);
// printf("/nCopyFile()'s ErrorInformation:%s/n",FormattedErrorInfo);
MessageBox(NULL,FormattedErrorInfo,"Error",MB_OK|MB_ICONINFORMATION);
}
/*//////////////////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////////////////*/
//Notice the file pointer all the time,this is very important.
void main(int argc,char *argv[])
{
HANDLE hDestinationFile=NULL;
//////////////////////////////////////////////////////////////////////
DWORD i=0;
DWORD j=0;
DWORD k=0;
DWORD NumberOfBytesRead=0; //Number of bytes read
WORD MZSignature=0; // MZ signature
DWORD ImageNtSignature=0; //PE signature
DWORD OffsetOfNewHeader=0;
DWORD NumberOfSections=0;
DWORD SizeOfOptionalHeader=0;
DWORD SizeOfSectionTable=0; //size of section table
HANDLE hGlobalAllocatedMemory=NULL; //use GlobalAlloc();
HANDLE hGlobalAllocatedMemoryOfDataDirectory=NULL;
PIMAGE_SECTION_HEADER pImageSectionHeader=NULL; //a pointer to IMAGE_SECTION_TABLE
PIMAGE_DATA_DIRECTORY pImageDataDirectory; //a pointer to IMAGE_DATA_DIRECTORY
///////////////////////////////////////////////////////////////////////////////////////////////////////////////
IMAGE_DOS_HEADER ImageDosHeader;
IMAGE_NT_HEADERS ImageNTHeaders;
IMAGE_FILE_HEADER ImageFileHeader;
IMAGE_OPTIONAL_HEADER ImageOptionalHeader;
IMAGE_SECTION_HEADER ImageSectionHeader;
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////
IMAGE_EXPORT_DIRECTORY ImageExportDirectory; //Export and Import
IMAGE_IMPORT_DESCRIPTOR ImageImportDescriptor;
PIMAGE_EXPORT_DIRECTORY pImageExportDirectory=NULL;
PIMAGE_IMPORT_DESCRIPTOR pImageImportDescriptor=NULL;
DWORD *pExportAddressTableEntry=NULL; //pointer
DWORD *pExportNamePointerTableEntry=NULL;
WORD *pExportOrdinalTableEntry=NULL;
DWORD SizeOfRawData=0;
DWORD PointerToRawData=0;
DWORD VirtualAddress=0;
DWORD CountOfImportDirectoryEntries=0;
DWORD RvaOfExportDirectoryTable=0;
DWORD RvaOfImportDirectoryTable=0;
DWORD DestinationSectionPosition=0; //Destination Section Position
DWORD FilePointerToIMAGE_EXPORT_DERECTORY=0; //file pointer
DWORD FilePointerToImportDirectoryTable=0;
DWORD FilePointerOfExportedDllName=0;
TCHAR ExportedDllName[MAX_PATH];
TCHAR ImportedDllName[MAX_PATH]; //Imported Dll Name
DWORD FilePointerOfExportAddressTable=0; //file pointer
DWORD FilePointerOfExportOrdinalTable=0;
DWORD FilePointerOfExportNamePointerTable=0;
HANDLE hGlobalMemoryForExportAddressTable=NULL; //Global memory allocated
HANDLE hGlobalMemoryForExportOrdinalTable=NULL;
HANDLE hGlobalMemoryForExportNamePointerTable=NULL;
HANDLE hGlobalMemoryForImportDirectoryTable=NULL;
HANDLE hGlobalMemoryForImportDirectoryTable2=NULL;
HANDLE hGlobalMemoryForCount=NULL;
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////
RtlZeroMemory(&ImageDosHeader,sizeof(IMAGE_DOS_HEADER));
RtlZeroMemory(&ImageNTHeaders,sizeof(IMAGE_NT_HEADERS));
RtlZeroMemory(&ImageFileHeader,sizeof(IMAGE_FILE_HEADER));
RtlZeroMemory(&ImageOptionalHeader,sizeof(IMAGE_OPTIONAL_HEADER));
RtlZeroMemory(&ImageSectionHeader,sizeof(IMAGE_SECTION_HEADER));
RtlZeroMemory(&ImageExportDirectory,sizeof(IMAGE_EXPORT_DIRECTORY)); //Export and Import
RtlZeroMemory(&ImageImportDescriptor,sizeof(IMAGE_IMPORT_DESCRIPTOR));
if(argc!=2)
{
printf("Error./nUSAGE:peinfo.exe DestinationFileName/n");
return;
}
hDestinationFile=CreateFile(argv[1],
FILE_WRITE_DATA|FILE_READ_DATA,
FILE_SHARE_WRITE,NULL,OPEN_ALWAYS,FILE_ATTRIBUTE_ARCHIVE,NULL);
OutputErrorInfo(GetLastError());
// OpenFile(DestinationPEFile,NULL,NULL);
if(hDestinationFile==INVALID_HANDLE_VALUE)
{
printf("/nCreateFile() fails!Can't open file. Please try again!/n");
return;
}
if(!ReadFile(hDestinationFile,&MZSignature,2,&NumberOfBytesRead,NULL))
{
printf("/nReadFile() fails! Please try again./n");
return;
}
if(NumberOfBytesRead!=2)
{
printf("/nReadFile() fails! Can't get the MZSignature./n");
return;
}
if(MZSignature!=0x5A4D)
{
printf("/nThis file is not a valid PE file./n");
printf("/nThe value of MZSignature is:%#x/n",MZSignature);
return;
}
SetFilePointer(hDestinationFile,0,NULL,FILE_BEGIN); //Revert the file pointer,this is very important.
ReadFile(hDestinationFile,&ImageDosHeader,
sizeof(IMAGE_DOS_HEADER),&NumberOfBytesRead,NULL);
if(NumberOfBytesRead!=sizeof(IMAGE_DOS_HEADER))
{
printf("/nReadFile() fails! Can't get IMAGE_DOS_HEADER./n");
return;
}
else
{
printf("/nGet IMAGE_DOS_HEADER successfully!/n");
}
////////////////////////////////////Output the information in the IMAGE_DOS_HEADER
printf("ImageDosHeader.e_magic: %#x/n",ImageDosHeader.e_magic);
printf("ImageDosHeader.e_crlc: %#x/n",ImageDosHeader.e_crlc); //Relocations
printf("ImageDosHeader.e_ss: %#x/n",ImageDosHeader.e_ss);
printf("ImageDosHeader.e_sp: %#x/n",ImageDosHeader.e_sp);
printf("ImageDosHeader.e_csum: %#x/n",ImageDosHeader.e_csum); //check sum
printf("ImageDosHeader.e_ip: %#x/n",ImageDosHeader.e_ip);
printf("ImageDosHeader.e_cs: %#x/n",ImageDosHeader.e_cs);
printf("ImageDosHeader.e_lfarlc: %#x/n",ImageDosHeader.e_lfarlc); //File address of relocation table
printf("ImageDosHeader.e_oemid: %#x/n",ImageDosHeader.e_oemid);
printf("ImageDosHeader.e_oeminfo: %#x/n",ImageDosHeader.e_oeminfo);
printf("ImageDosHeader.e_lfanew: %#x/n",ImageDosHeader.e_lfanew); //file address of new exe header
// printf("ImageDosHeader.e_crlc%#x/n",ImageDosHeader.e_sp);
//......
if(ImageDosHeader.e_magic!=MZSignature) //MZ header
{
printf("/nValue of ImageDosHeader.e_magic is:");
printf("%#x,%#d/n",ImageDosHeader.e_magic,ImageDosHeader.e_magic);
}
OffsetOfNewHeader=ImageDosHeader.e_lfanew; //File address of new exe header
SetFilePointer(hDestinationFile,(LONG)OffsetOfNewHeader,NULL,FILE_BEGIN);
// OutputErrorInfo(GetLastError());
ReadFile(hDestinationFile,&ImageNTHeaders,
sizeof(IMAGE_NT_HEADERS),&NumberOfBytesRead,NULL); //Retrieve IMAGE_NT_HEADERS
if(NumberOfBytesRead!=sizeof(IMAGE_NT_HEADERS))
{
printf("/nReadFile() fails! Cant' get IMAGE_NT_HEADER./n");
return;
}
else
{
printf("/nGet IMAGE_NT_HEADERS successfully!/n");
}
//Output the information in IMAGE_NT_HEADER
printf("ImageNTHeaders.Signature: %#x/n",ImageNTHeaders.Signature);
SetFilePointer(hDestinationFile,OffsetOfNewHeader+4,NULL,FILE_BEGIN); //Set the file pointer to point to IMAGE_FILE_HEADER
ReadFile(hDestinationFile,&ImageFileHeader,
sizeof(IMAGE_FILE_HEADER),&NumberOfBytesRead,NULL); //Retrieve IMAGE_FILE_HEADER
if(NumberOfBytesRead!=sizeof(IMAGE_FILE_HEADER))
{
printf("/nReadFile() fails! Can't get IMAGE_FILE_HEADER./n");
return;
}
else
{
printf("/nGet IMAGE_FILE_HEADER successfully!/n");
}
//Output the information in IMAGE_FILE_HEADER
printf("ImageFileHeader.Machine: %#x/n",ImageFileHeader.Machine);
printf("ImageFileHeader.NumberOfSections: %#x/n",ImageFileHeader.NumberOfSections);
printf("ImageFileHeader.TimeDateStamp: %#x/n",ImageFileHeader.TimeDateStamp);
printf("ImageFileHeader.SizeOfOptionalHeader: %#x/n",ImageFileHeader.SizeOfOptionalHeader);
printf("ImageFileHeader.Characteristics: %#x/n",ImageFileHeader.Characteristics);
ReadFile(hDestinationFile,&ImageOptionalHeader,
sizeof(IMAGE_OPTIONAL_HEADER),&NumberOfBytesRead,NULL); //Retrieve IMAGE_OPTIONAL_HEADER
if(NumberOfBytesRead!=sizeof(IMAGE_OPTIONAL_HEADER))
{
printf("/nReadFile() fails! Can't get IMAGE_OPTIONAL_HEADER./n");
return;
}
else
{
printf("/nGet IMAGE_OPTIONAL_HEADER successfully!/n");
}
//Output the information in the IMAGE_OPTIONAL_HEADER
//
//Standard fields.
//
printf("--------------------------------------------->>>Standard fields/n");
printf("ImageOptionalHeader.Magic: %#x/n",ImageOptionalHeader.Magic); //Standard fields
printf("ImageOptionalHeader.MajorLinkerVersion: %#x/n",ImageOptionalHeader.MajorLinkerVersion);
printf("ImageOptionalHeader.MinorLinkerVersion: %#x/n",ImageOptionalHeader.MinorLinkerVersion);
printf("ImageOptionalHeader.SizeOfCode: %#x/n",ImageOptionalHeader.SizeOfCode);
printf("ImageOptionalHeader.SizeOfInitializedData: %#x/n",ImageOptionalHeader.SizeOfInitializedData);
printf("ImageOptionalHeader.SizeOfUninitializedData: %#x/n",ImageOptionalHeader.SizeOfUninitializedData);
printf("ImageOptionalHeader.AddressOfEntryPoint: %#x/n",ImageOptionalHeader.AddressOfEntryPoint);
printf("ImageOptionalHeader.BaseOfCode: %#x/n",ImageOptionalHeader.BaseOfCode);
printf("ImageOptionalHeader.BaseOfData: %#x/n",ImageOptionalHeader.BaseOfData);
//
////NT additional fields
//
printf("---------------------------------------------->>>NT additional fields/n");
printf("ImageOptionalHeader.ImageBase: %#x/n",ImageOptionalHeader.ImageBase);
printf("ImageOptionalHeader.SectionAlignment: %#x/n",ImageOptionalHeader.SectionAlignment);
printf("ImageOptionalHeader.FileAlignment: %#x/n",ImageOptionalHeader.FileAlignment);
printf("ImageOptionalHeader.MajorOperatingSystemVersion: %#x/n",ImageOptionalHeader.MajorOperatingSystemVersion);
printf("ImageOptionalHeader.MinorOperatingSystemVersion: %#x/n",ImageOptionalHeader.MinorOperatingSystemVersion);
printf("ImageOptionalHeader.MajorImageVersion: %#x/n",ImageOptionalHeader.MajorImageVersion);
printf("ImageOptionalHeader.MinorImageVersion: %#x/n",ImageOptionalHeader.MinorImageVersion);
printf("ImageOptionalHeader.MajorSubsystemVersion: %#x/n",ImageOptionalHeader.MajorSubsystemVersion);
printf("ImageOptionalHeader.MinorSubsystemVersion: %#x/n",ImageOptionalHeader.MinorSubsystemVersion);
printf("ImageOptionalHeader.Win32VersionValue: %#x/n",ImageOptionalHeader.Win32VersionValue);
printf("ImageOptionalHeader.SizeOfImage: %#x/n",ImageOptionalHeader.SizeOfImage);
printf("ImageOptionalHeader.SizeOfHeaders: %#x/n",ImageOptionalHeader.SizeOfHeaders);
printf("ImageOptionalHeader.CheckSum: %#x/n",ImageOptionalHeader.CheckSum);
printf("ImageOptionalHeader.Subsystem: %#x/n",ImageOptionalHeader.Subsystem);
printf("ImageOptionalHeader.DllCharacteristics: %#x/n",ImageOptionalHeader.DllCharacteristics);
printf("ImageOptionalHeader.SizeOfStackReserve: %#x/n",ImageOptionalHeader.SizeOfStackReserve);
printf("ImageOptionalHeader.SizeOfStackCommit: %#x/n",ImageOptionalHeader.SizeOfStackCommit);
printf("ImageOptionalHeader.SizeOfHeapReserve: %#x/n",ImageOptionalHeader.SizeOfHeapReserve);
printf("ImageOptionalHeader.SizeOfHeapCommit: %#x/n",ImageOptionalHeader.SizeOfHeapCommit);
printf("ImageOptionalHeader.LoaderFlags: %#x/n",ImageOptionalHeader.LoaderFlags);
printf("ImageOptionalHeader.NumberOfRvaAndSizes: %#x/n",ImageOptionalHeader.NumberOfRvaAndSizes);
//Add the information in IMAGE_DATA_DIRECTORY to complete it.
printf("-------------------------------------------------------------------/n");
printf("Information in IMAGE_DATA_DIRECTORY/n");
hGlobalAllocatedMemoryOfDataDirectory=GlobalAlloc(GPTR,
sizeof(IMAGE_DATA_DIRECTORY)*ImageOptionalHeader.NumberOfRvaAndSizes); //Allocate memory and initialize with zero
pImageDataDirectory=(PIMAGE_DATA_DIRECTORY)hGlobalAllocatedMemoryOfDataDirectory;
RtlCopyMemory(pImageDataDirectory,ImageOptionalHeader.DataDirectory, //Get IMAGE_DATA_DIRECTORY
sizeof(IMAGE_DATA_DIRECTORY)*ImageOptionalHeader.NumberOfRvaAndSizes);
for(i=0;i<ImageOptionalHeader.NumberOfRvaAndSizes;i++)
{
printf("-------------------------------------/n");
switch(i)
{
case 0:
printf("Export Table:/n");
break;
case 1:
printf("Import Table:/n");
break;
case 2:
printf("Resource Table:/n");
break;
case 3:
printf("Exception Table:/n");
break;
case 4:
printf("Certificate Table:/n");
break;
case 5:
printf("Base Relocation Table:/n");
break;
case 6:
printf("Debug:/n");
break;
case 7:
printf("Architecture:/n");
break;
case 8:
printf("Global Ptr:/n");
break;
case 9:
printf("TLS Table:/n");
break;
case 10:
printf("Load Config Table:/n");
break;
case 11:
printf("Bound Import:/n");
break;
case 12:
printf("IAT:/n");
break;
case 13:
printf("Delay Import Descriptor:/n");
break;
case 14:
printf("CLR Runtime Header:/n");
break;
case 15:
printf("Reserved, must be zero:/n");
break;
}
printf("VirtualAddress: %#x/n",(pImageDataDirectory+i)->VirtualAddress);
printf("Size: %#x/n",(pImageDataDirectory+i)->Size);
// printf("-------------------------------------/n");
}
///////////////////////////////////////////////////////////////////////////////////////////////////////////////
NumberOfSections=ImageFileHeader.NumberOfSections; //Number of sections
SizeOfOptionalHeader=ImageFileHeader.SizeOfOptionalHeader; //size of optional header
if(SizeOfOptionalHeader!=sizeof(IMAGE_OPTIONAL_HEADER))
{
printf("/nThere is an error./nThe value of ImageFileHeader.SizeOfOptionalHeader is incorrect!/n");
}
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////
SizeOfSectionTable=sizeof(IMAGE_SECTION_HEADER)*NumberOfSections; //Get the size of Section Table
hGlobalAllocatedMemory=GlobalAlloc(GPTR,SizeOfSectionTable); //Allocate memory and initialize with zero
if(hGlobalAllocatedMemory==NULL)
{
printf("/nGlobalAlloc() failed! Please try again./n"); //if failed,return
return;
}
// RtlZeroMemory(hGlobalAllocatedMemory,SizeOfSectionTable); //Initialize with zero,this operation has been completed!
pImageSectionHeader=(PIMAGE_SECTION_HEADER)hGlobalAllocatedMemory; //Convert a handle to a pointer to IMAGE_SECTION_HEADER
for(i=0;i<NumberOfSections;i++) //Retrieve the Section Table
{
ReadFile(hDestinationFile,pImageSectionHeader+i,
sizeof(IMAGE_SECTION_HEADER),&NumberOfBytesRead,NULL);
if(NumberOfBytesRead!=sizeof(IMAGE_SECTION_HEADER))
{
printf("Error.Can't get IMAGE_SECTION_HEADER./n");
}
}
printf("------------------------------------------------------/n");
printf("------------------------------------------------------/n");
printf("/nGet IMAGE_SECTION_HEADER successfully!/n");
/*
//The following code fragment has the identical effect to the above for()
ReadFile(hDestinationFile,pImageSectionHeader,
SizeOfSectionTable,NULL,NULL); //Retrieve the Section Table
*/
for(i=0;i<NumberOfSections;i++)
{
printf("/nThe name of the section%d: ",i);
printf("%s/n",(*(pImageSectionHeader+i)).Name);
printf("Misc:%#x/n",(*(pImageSectionHeader+i)).Misc);
printf("VirtualAddress: %#x/n",(*(pImageSectionHeader+i)).VirtualAddress);
printf("SizeOfRawData: %#x/n",(*(pImageSectionHeader+i)).SizeOfRawData);
printf("PointerToRawData: %#x/n",(*(pImageSectionHeader+i)).PointerToRawData);
printf("PointerToRelocations: %#x/n",(*(pImageSectionHeader+i)).PointerToRelocations);
printf("PointerToLinenumbers: %#x/n",(*(pImageSectionHeader+i)).PointerToLinenumbers);
printf("NumberOfRelocations: %#x/n",(*(pImageSectionHeader+i)).NumberOfRelocations);
printf("NumberOfLinenumbers: %#x/n",(*(pImageSectionHeader+i)).NumberOfLinenumbers);
printf("Characteristics: %#x/n",(*(pImageSectionHeader+i)).Characteristics);
printf("------------------------------------------------------");
}
//Output information of .idata section
for(i=0;i<NumberOfSections;i++)
{
if(StrCmp((*(pImageSectionHeader+i)).Name,".idata")==0)
{
SizeOfRawData=(*(pImageSectionHeader+i)).SizeOfRawData;
PointerToRawData=(*(pImageSectionHeader+i)).PointerToRawData;
VirtualAddress=(*(pImageSectionHeader+i)).VirtualAddress;
SetFilePointer(hDestinationFile,PointerToRawData,NULL,FILE_BEGIN);
hGlobalMemoryForCount=GlobalAlloc(GPTR,sizeof(IMAGE_IMPORT_DESCRIPTOR)); //Allocate memory and initialize with zero
do
{
ReadFile(hDestinationFile,hGlobalMemoryForCount,sizeof(IMAGE_IMPORT_DESCRIPTOR),&NumberOfBytesRead,NULL);
if(*((DWORD*)hGlobalMemoryForCount)==0 && *((DWORD*)hGlobalMemoryForCount+1)==0)
{
break;
}
else
CountOfImportDirectoryEntries++;
} while (1);
GlobalFree(hGlobalMemoryForCount); //Free the allocated memory
if(CountOfImportDirectoryEntries==0)
{
printf("/nThe count of Import Directory Entries is 0/n");//*******************************************/
return;
}
hGlobalMemoryForImportDirectoryTable=GlobalAlloc(GPTR,
sizeof(IMAGE_IMPORT_DESCRIPTOR)*CountOfImportDirectoryEntries);
pImageImportDescriptor=(PIMAGE_IMPORT_DESCRIPTOR)hGlobalMemoryForImportDirectoryTable;
SetFilePointer(hDestinationFile,PointerToRawData,NULL,FILE_BEGIN);
ReadFile(hDestinationFile,hGlobalMemoryForImportDirectoryTable,
sizeof(IMAGE_IMPORT_DESCRIPTOR)*CountOfImportDirectoryEntries,
&NumberOfBytesRead,NULL); //Get ImportDirectoryTable
if(NumberOfBytesRead==sizeof(IMAGE_IMPORT_DESCRIPTOR)*CountOfImportDirectoryEntries)
{
printf("/n/nGet Import Directory Table successfully!/n");
}
else
{
printf("/nCan't get Import Directory Table./n");
return;
}
printf("/n");
for(j=0;j<CountOfImportDirectoryEntries;j++)
{
DWORD temp=0;
DWORD CountOfImportLookupTableEntries=0;
DWORD *PointToLookupTableEntries=NULL;
HANDLE GlobalMemoryForImportLookupTableEntries=NULL;
TCHAR DllName[MAX_PATH];
//Output Import Directory Table entries
printf("IMAGE_IMPORT_DESCRIPTOR.Characteristics: %#x/n",(*(pImageImportDescriptor+j)).Characteristics);
printf("IMAGE_IMPORT_DESCRIPTOR.FirstThunk: %#x/n",(*(pImageImportDescriptor+j)).FirstThunk);
printf("IMAGE_IMPORT_DESCRIPTOR.ForwarderChain: %#x/n",(*(pImageImportDescriptor+j)).ForwarderChain);
printf("IMAGE_IMPORT_DESCRIPTOR.Name: %#x/n",(*(pImageImportDescriptor+j)).Name);
printf("IMAGE_IMPORT_DESCRIPTOR.OriginalFirstThunk: %#x/n",(*(pImageImportDescriptor+j)).OriginalFirstThunk);
printf("IMAGE_IMPORT_DESCRIPTOR.TimeDateStamp: %#x/n",(*(pImageImportDescriptor+j)).TimeDateStamp);
//Output the corresponding dll name
temp=(*(pImageImportDescriptor+j)).Name-VirtualAddress+PointerToRawData;
SetFilePointer(hDestinationFile,temp,NULL,FILE_BEGIN);
ReadFile(hDestinationFile,DllName,MAX_PATH,&NumberOfBytesRead,NULL);
printf("/n%s/n",DllName);
///////////////////////////////////////////////////////////////////////////////////////////
temp=(*(pImageImportDescriptor+j)).Characteristics-VirtualAddress+PointerToRawData; //Get file pointer
SetFilePointer(hDestinationFile,temp,NULL,FILE_BEGIN);
do
{
ReadFile(hDestinationFile,&temp,4,&NumberOfBytesRead,NULL);
if(temp==0)
{
break;
}
else
CountOfImportLookupTableEntries++;
} while (1);
GlobalMemoryForImportLookupTableEntries=GlobalAlloc(GPTR,CountOfImportLookupTableEntries*4);
temp=(*(pImageImportDescriptor+j)).Characteristics-VirtualAddress+PointerToRawData; //Get file pointer
SetFilePointer(hDestinationFile,temp,NULL,FILE_BEGIN);
ReadFile(hDestinationFile,GlobalMemoryForImportLookupTableEntries,
CountOfImportLookupTableEntries*4,&NumberOfBytesRead,NULL); //Retrieve Import Lookup Table
PointToLookupTableEntries=(DWORD*)GlobalMemoryForImportLookupTableEntries;
printf("/n/n");
printf("Rva||Ordinal--Hint----ImportedFunctionName/n");/////88888
for(k=0;k<CountOfImportLookupTableEntries;k++)
{
WORD Ordinal=0;
TCHAR FunctionName[MAX_PATH];
printf("%-4d%#-8x",k,*(PointToLookupTableEntries+k)); //Output Import Lookup Table entries
temp=*(PointToLookupTableEntries+k)-VirtualAddress+PointerToRawData;
SetFilePointer(hDestinationFile,temp,NULL,FILE_BEGIN);
ReadFile(hDestinationFile,&Ordinal,2,&NumberOfBytesRead,NULL); //Get the ordinal in hint/name table
printf(" %#-8x ",Ordinal);
ReadFile(hDestinationFile,FunctionName,MAX_PATH,&NumberOfBytesRead,NULL);
printf("%s/n",FunctionName);
}
printf("-------------------------------------------------------/n");
}
} //if end
}
//Output the information in the .edata section
if((*(pImageDataDirectory+0)).VirtualAddress!=0 && (*(pImageDataDirectory+0)).Size!=0)
{
RvaOfExportDirectoryTable=(*(pImageDataDirectory+0)).VirtualAddress; //Get the RVA of ExportDirectoryTable*****
printf("/nThis file has Export Directory Table./n");
}
else
{
printf("/nThis file has no Export Directory Table./n");
goto next;
}
for(i=0;i<NumberOfSections;i++)
{
if(RvaOfExportDirectoryTable>=(pImageSectionHeader+i)->VirtualAddress)
{
if( RvaOfExportDirectoryTable<=(pImageSectionHeader+i)->VirtualAddress+(pImageSectionHeader+i)->SizeOfRawData)
{
DestinationSectionPosition=i;
break;
}
}
}
FilePointerToIMAGE_EXPORT_DERECTORY= (*(pImageSectionHeader+DestinationSectionPosition)).PointerToRawData+
RvaOfExportDirectoryTable-
(*(pImageSectionHeader+DestinationSectionPosition)).VirtualAddress; //Notice the priority
SetFilePointer(hDestinationFile,FilePointerToIMAGE_EXPORT_DERECTORY,NULL,FILE_BEGIN);
ReadFile(hDestinationFile,&ImageExportDirectory,sizeof(IMAGE_EXPORT_DIRECTORY),
&NumberOfBytesRead,NULL);
if(NumberOfBytesRead==sizeof(IMAGE_EXPORT_DIRECTORY))
{
printf("/nGet IMAGE_EXPORT_DIRECTORY successfully!/n");
}
else
{
printf("/nCan't get IMAGE_EXPORT_DIRECTORY./n");
return;
}
printf("ImageExportDirectory.Characteristics: %#x/n",ImageExportDirectory.Characteristics);
printf("ImageExportDirectory.TimeDateStamp: %#x/n",ImageExportDirectory.TimeDateStamp);
printf("ImageExportDirectory.MajorVersion: %#x/n",ImageExportDirectory.MajorVersion);
printf("ImageExportDirectory.MinorVersion: %#x/n",ImageExportDirectory.MinorVersion);
printf("ImageExportDirectory.Name: %#x/n",ImageExportDirectory.Name);
printf("ImageExportDirectory.Base: %#x/n",ImageExportDirectory.Base);
printf("ImageExportDirectory.NumberOfFunctions: %#x/n",ImageExportDirectory.NumberOfFunctions);
printf("ImageExportDirectory.NumberOfNames: %#x/n",ImageExportDirectory.NumberOfNames);
printf("ImageExportDirectory.AddressOfFunctions: %#x/n",ImageExportDirectory.AddressOfFunctions);
printf("ImageExportDirectory.AddressOfNames: %#x/n",ImageExportDirectory.AddressOfNames);
printf("ImageExportDirectory.AddressOfNameOrdinals: %#x/n",ImageExportDirectory.AddressOfNameOrdinals);
FilePointerOfExportedDllName=(*(pImageSectionHeader+DestinationSectionPosition)).PointerToRawData+
ImageExportDirectory.Name-
(*(pImageSectionHeader+DestinationSectionPosition)).VirtualAddress;
SetFilePointer(hDestinationFile,FilePointerOfExportedDllName,NULL,FILE_BEGIN);
ReadFile(hDestinationFile,ExportedDllName,MAX_PATH,
&NumberOfBytesRead,NULL);
printf("/n%s/n",ExportedDllName);
//Get the corresponding file pointer
FilePointerOfExportAddressTable=(*(pImageSectionHeader+DestinationSectionPosition)).PointerToRawData+
ImageExportDirectory.AddressOfFunctions-(*(pImageSectionHeader+DestinationSectionPosition)).VirtualAddress;
FilePointerOfExportNamePointerTable=(*(pImageSectionHeader+DestinationSectionPosition)).PointerToRawData+
ImageExportDirectory.AddressOfNames-(*(pImageSectionHeader+DestinationSectionPosition)).VirtualAddress;
FilePointerOfExportOrdinalTable=(*(pImageSectionHeader+DestinationSectionPosition)).PointerToRawData+
ImageExportDirectory.AddressOfNameOrdinals-(*(pImageSectionHeader+DestinationSectionPosition)).VirtualAddress;
//Allocate memory
hGlobalMemoryForExportAddressTable=GlobalAlloc(GPTR,ImageExportDirectory.NumberOfFunctions*4);
hGlobalMemoryForExportNamePointerTable=GlobalAlloc(GPTR,ImageExportDirectory.NumberOfNames*4);
hGlobalMemoryForExportOrdinalTable=GlobalAlloc(GPTR,ImageExportDirectory.NumberOfNames*2);
//Set file pointer and read data from file
SetFilePointer(hDestinationFile,FilePointerOfExportAddressTable,NULL,FILE_BEGIN);
ReadFile(hDestinationFile,hGlobalMemoryForExportAddressTable,ImageExportDirectory.NumberOfFunctions*4,
&NumberOfBytesRead,NULL);
SetFilePointer(hDestinationFile,FilePointerOfExportNamePointerTable,NULL,FILE_BEGIN);
ReadFile(hDestinationFile,hGlobalMemoryForExportNamePointerTable,ImageExportDirectory.NumberOfNames*4,
&NumberOfBytesRead,NULL);
SetFilePointer(hDestinationFile,FilePointerOfExportOrdinalTable,NULL,FILE_BEGIN);
ReadFile(hDestinationFile,hGlobalMemoryForExportOrdinalTable,ImageExportDirectory.NumberOfNames*2,
&NumberOfBytesRead,NULL);
pExportAddressTableEntry=(DWORD*)hGlobalMemoryForExportAddressTable;
pExportNamePointerTableEntry=(DWORD*)hGlobalMemoryForExportNamePointerTable;
pExportOrdinalTableEntry=(WORD*)hGlobalMemoryForExportOrdinalTable;
printf("/nOrdinal-Index--RVA----------------FunctionName/n");
for(i=0;i<ImageExportDirectory.NumberOfFunctions;i++)
{
TCHAR ExportedFunctionName[MAX_PATH];
DWORD FilePointerOfExportedFunctionName=0;
printf("%#-7x ",*(pExportOrdinalTableEntry+i)+ImageExportDirectory.Base);
printf("%#-6x ",*(pExportOrdinalTableEntry+i));
printf("%#-8x ",*(pExportAddressTableEntry+i));
printf("%#-6x ",*(pExportNamePointerTableEntry+i));
printf("-->");
FilePointerOfExportedFunctionName=*(pExportNamePointerTableEntry+i)-
(*(pImageSectionHeader+DestinationSectionPosition)).VirtualAddress+
(*(pImageSectionHeader+DestinationSectionPosition)).PointerToRawData;
SetFilePointer(hDestinationFile,FilePointerOfExportedFunctionName,NULL,FILE_BEGIN);
ReadFile(hDestinationFile,ExportedFunctionName,MAX_PATH,
&NumberOfBytesRead,NULL);
printf(" %s",ExportedFunctionName);
printf("/n");
}
//Close handle to free allocated memory
CloseHandle(hGlobalMemoryForExportAddressTable);
CloseHandle(hGlobalMemoryForExportNamePointerTable);
CloseHandle(hGlobalMemoryForExportOrdinalTable);
////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
//Output the information in .idata section
next:
if((*(pImageDataDirectory+1)).VirtualAddress!=0 && (*(pImageDataDirectory+1)).Size!=0)
{
RvaOfImportDirectoryTable=(*(pImageDataDirectory+1)).VirtualAddress; //Get the RVA of ImportDirectoryTable*****
printf("/nThis file has Import Directory Table./n");
}
else
{
printf("/nThis file has no Import Directory Table./n");
goto over;
}
for(i=0;i<NumberOfSections;i++) //Search the destination section
{
if(RvaOfImportDirectoryTable>=(pImageSectionHeader+i)->VirtualAddress)
{
if( RvaOfImportDirectoryTable<=(pImageSectionHeader+i)->VirtualAddress+(pImageSectionHeader+i)->SizeOfRawData)
{
DestinationSectionPosition=i;
break;
}
}
}
//Get the file pointer of Import Directory Table
SizeOfRawData=(*(pImageSectionHeader+DestinationSectionPosition)).SizeOfRawData;
PointerToRawData=(*(pImageSectionHeader+DestinationSectionPosition)).PointerToRawData;
VirtualAddress=(*(pImageSectionHeader+DestinationSectionPosition)).VirtualAddress;
FilePointerToImportDirectoryTable= (*(pImageSectionHeader+DestinationSectionPosition)).PointerToRawData+
RvaOfImportDirectoryTable-
(*(pImageSectionHeader+DestinationSectionPosition)).VirtualAddress; //Notice the operator's priority
SetFilePointer(hDestinationFile,FilePointerToImportDirectoryTable,NULL,FILE_BEGIN); //Set the file pointer
CountOfImportDirectoryEntries=0; //Initialize with zero
hGlobalMemoryForCount=GlobalAlloc(GPTR,sizeof(IMAGE_IMPORT_DESCRIPTOR));
do
{
ReadFile(hDestinationFile,hGlobalMemoryForCount,sizeof(IMAGE_IMPORT_DESCRIPTOR),&NumberOfBytesRead,NULL);
if(*((DWORD*)hGlobalMemoryForCount)==0 && *((DWORD*)hGlobalMemoryForCount+1)==0) //Why ?Unhandled Exception
{
break;
}
else
CountOfImportDirectoryEntries++;
} while (1);
if(CountOfImportDirectoryEntries==0)
{
printf("/nThe count of Import Directory Entries is 0/n");//Output error information
return;
}
else
{
printf("/nCount of ImportDirectoryEntries is:%d/n",CountOfImportDirectoryEntries);
}
hGlobalMemoryForImportDirectoryTable2=GlobalAlloc(GPTR,sizeof(IMAGE_IMPORT_DESCRIPTOR)*
CountOfImportDirectoryEntries);
pImageImportDescriptor=(PIMAGE_IMPORT_DESCRIPTOR)hGlobalMemoryForImportDirectoryTable2;
SetFilePointer(hDestinationFile,FilePointerToImportDirectoryTable,NULL,FILE_BEGIN); //Set the file pointer
/*Notice : To set the file pointer before calling ReadFile() is very important.*/
ReadFile(hDestinationFile,hGlobalMemoryForImportDirectoryTable2,
sizeof(IMAGE_IMPORT_DESCRIPTOR)*CountOfImportDirectoryEntries,
&NumberOfBytesRead,NULL); //Get ImportDirectoryTable
if(NumberOfBytesRead==sizeof(IMAGE_IMPORT_DESCRIPTOR)*CountOfImportDirectoryEntries)
{
printf("Get Import Directory Table successfully!/n/n");
}
else
{
printf("/nCan't get Import Directory Table./n");
return;
}
for(i=0;i<CountOfImportDirectoryEntries;i++)
{
DWORD FilePointerOfImportedDllName=0;
DWORD FilePointerOfImportLookupTable=0;
WORD temp=0;
DWORD CountOfImportLookupTableEntries=0;
DWORD *PointerToImportLookupTableEntry=NULL; //pointer to Import Lookup Table entry
HANDLE hGlobalMemoryForImportLookupTable=NULL;
//Output Import Directory Table entries
printf("IMAGE_IMPORT_DESCRIPTOR.Characteristics: %#x(union)/n",(*(pImageImportDescriptor+i)).Characteristics);
printf("IMAGE_IMPORT_DESCRIPTOR.OriginalFirstThunk: %#x(union)/n",(*(pImageImportDescriptor+i)).OriginalFirstThunk);
printf("IMAGE_IMPORT_DESCRIPTOR.TimeDateStamp: %#x/n",(*(pImageImportDescriptor+i)).TimeDateStamp);
printf("IMAGE_IMPORT_DESCRIPTOR.ForwarderChain: %#x/n",(*(pImageImportDescriptor+i)).ForwarderChain);
printf("IMAGE_IMPORT_DESCRIPTOR.Name: %#x/n",(*(pImageImportDescriptor+i)).Name);
printf("IMAGE_IMPORT_DESCRIPTOR.FirstThunk: %#x/n",(*(pImageImportDescriptor+i)).FirstThunk);
FilePointerOfImportedDllName=(*(pImageImportDescriptor+i)).Name-VirtualAddress+PointerToRawData;
SetFilePointer(hDestinationFile,FilePointerOfImportedDllName,NULL,FILE_BEGIN);
RtlZeroMemory(ImportedDllName,MAX_PATH);
ReadFile(hDestinationFile,ImportedDllName,MAX_PATH,&NumberOfBytesRead,NULL);
printf("/n%s/n",ImportedDllName); //output dll name
FilePointerOfImportLookupTable=(*(pImageImportDescriptor+i)).Characteristics-VirtualAddress+PointerToRawData;//file pointer
SetFilePointer(hDestinationFile,FilePointerOfImportLookupTable,NULL,FILE_BEGIN); //Set file pointer
do
{
ReadFile(hDestinationFile,&temp,4,&NumberOfBytesRead,NULL);
if(temp==0)
{
break;
}
else
CountOfImportLookupTableEntries++;
} while (1);
if(CountOfImportLookupTableEntries==0)
{
printf("Error.Count of ImportLookupTableEntries is 0./n");
return;
}
SetFilePointer(hDestinationFile,FilePointerOfImportLookupTable,NULL,FILE_BEGIN); //Set file pointer
hGlobalMemoryForImportLookupTable=GlobalAlloc(GPTR,CountOfImportLookupTableEntries*4);
ReadFile(hDestinationFile,hGlobalMemoryForImportLookupTable,CountOfImportLookupTableEntries*4,
&NumberOfBytesRead,NULL);
if(NumberOfBytesRead!=CountOfImportLookupTableEntries*4)
{
printf("/nError.Can't get ImportLookupTable./n");
return;
}
PointerToImportLookupTableEntry=(DWORD*)hGlobalMemoryForImportLookupTable;
printf("/nInformation in ImportLookupTable./n/n");
printf("Rva||Ordinal--Hint----ImportedFunctionName/n");
for(j=0;j<CountOfImportLookupTableEntries;j++)
{
DWORD Bitwise=0;
WORD Hint=0;
DWORD FilePoinerOfNameTable=0;
TCHAR ImportedFunctionName[MAX_PATH];
printf("%-4d %#-8x ",j,*(PointerToImportLookupTableEntry+j));
Bitwise=*(PointerToImportLookupTableEntry+j);
Bitwise=Bitwise & 0x80000000;
if(Bitwise!=0)
{
}
else
{
}
FilePoinerOfNameTable=*(PointerToImportLookupTableEntry+j)-VirtualAddress+PointerToRawData;
SetFilePointer(hDestinationFile,FilePoinerOfNameTable,NULL,FILE_BEGIN); //Set file pointer
ReadFile(hDestinationFile,&Hint,sizeof(WORD),
&NumberOfBytesRead,NULL);
printf("%#-8x ",Hint);
ReadFile(hDestinationFile,ImportedFunctionName,MAX_PATH,
&NumberOfBytesRead,NULL);
printf("%s/n",ImportedFunctionName);
}
printf("-------------------------------------------------------/n");
}
//Free the memory allocated
over:
GlobalFree(hGlobalMemoryForImportDirectoryTable2);
GlobalFree(hGlobalMemoryForImportDirectoryTable);
GlobalFree(hGlobalAllocatedMemory);
GlobalFree(hGlobalAllocatedMemoryOfDataDirectory);
CloseHandle(hDestinationFile);
}